tools/autoacl/deployment/autoacl.yaml [67:123]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Resources:

  CMK:
    Type: AWS::KMS::Key
    Properties:
      Description: Symetric Key for Encrypting Messages in Q
      Enabled: true
      EnableKeyRotation: true
      PendingWindowInDays: 7
      KeyPolicy:
        Version: 2012-10-17
        Id: node-key-policy
        Statement:
          -
            Sid: KeyManagement
            Effect: Allow
            Principal:
              AWS:
                Fn::Sub: arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
            Resource: '*'

          -
            Sid: "Allow access for Key User (SNS Service Principal)"
            Effect: Allow
            Principal:
              Service: sns.amazonaws.com
            Action:
              - kms:GenerateDataKey
              - kms:Decrypt
            Resource: '*'

          -
            Sid: "Allow access for Key User (Lambda Function)"
            Effect: Allow
            Principal:
              AWS:
               Fn::GetAtt: DriverFunctionRole.Arn
            Action:
             - kms:Decrypt
            Resource: '*'

  NQ:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



tools/autoingest/deployment/autoingest.yaml [68:124]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Resources:

  CMK:
    Type: AWS::KMS::Key
    Properties:
      Description: Symetric Key for Encrypting Messages in Q
      Enabled: true
      EnableKeyRotation: true
      PendingWindowInDays: 7
      KeyPolicy:
        Version: 2012-10-17
        Id: node-key-policy
        Statement:
          -
            Sid: KeyManagement
            Effect: Allow
            Principal:
              AWS:
                Fn::Sub: arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
            Resource: '*'

          -
            Sid: "Allow access for Key User (SNS Service Principal)"
            Effect: Allow
            Principal:
              Service: sns.amazonaws.com
            Action:
              - kms:GenerateDataKey
              - kms:Decrypt
            Resource: '*'

          -
            Sid: "Allow access for Key User (Lambda Function)"
            Effect: Allow
            Principal:
              AWS:
               Fn::GetAtt: DriverFunctionRole.Arn
            Action:
             - kms:Decrypt
            Resource: '*'

  NQ:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



